<html>
<head><meta charset="utf-8"><title>Writes to raw pointers considered harmful · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html">Writes to raw pointers considered harmful</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="169415900"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169415900" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169415900">(Jul 01 2019 at 17:51)</a>:</h4>
<p>Who else has written things like <code>*raw_ptr = &lt;...&gt;</code> and forgot that this will drop the old content in there and you should really use <code>ptr.write</code>? I certainly have, and this is also very easy to miss in a review.<br>
So, would it be a good idea to lint against such raw pointer writes unless the type does not need dropping, and suggest using a yet-to-be-introduced <code>ptr.write_and_drop</code> method instead?</p>



<a name="169416111"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169416111" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169416111">(Jul 01 2019 at 17:54)</a>:</h4>
<p>At some point, I stopped dereferencing raw pointers completely, and only use <code>read</code>/<code>write</code> methods, manually dropping when needed. The only time I dereference raw pointers is when I need a reference to the object in the memory location (<code>&amp;*ptr</code>).  So yeah, a <code>ptr.write_and_drop</code> method would make some code clearer. It is also kind of easy to forget that <code>write</code> doesn't drop.</p>



<a name="169416224"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169416224" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169416224">(Jul 01 2019 at 17:55)</a>:</h4>
<blockquote>
<p>It is also kind of easy to forget that write doesn't drop.</p>
</blockquote>
<p>true</p>



<a name="169447397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169447397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169447397">(Jul 02 2019 at 02:07)</a>:</h4>
<p>Having a raw pointer to a type that isn't Copy is already a special kind of crazy.</p>



<a name="169457774"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169457774" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nicole Mazzuca <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169457774">(Jul 02 2019 at 06:56)</a>:</h4>
<p>I agree that <code>*</code> on raw pointers is nearly always a bad idea, and I've had so many bugs that could be fixed by not allowing it (while I've never actually needed <code>*</code>, except for turning a raw pointer into a reference)</p>



<a name="169459073"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169459073" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169459073">(Jul 02 2019 at 07:26)</a>:</h4>
<p>no reason to disallow it with <code>Copy</code> types though?</p>



<a name="169459250"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169459250" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169459250">(Jul 02 2019 at 07:30)</a>:</h4>
<p>what's the advantage of allowing it ? <code>ptr.read()</code> works for <code>Copy</code> too - but now its 2 things you need to learn<br>
and <code>&amp;*ptr</code> and <code>&amp;ptr.read()</code> do 2 subtly different things</p>



<a name="169459356"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169459356" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169459356">(Jul 02 2019 at 07:32)</a>:</h4>
<p>when working with pointers i wish we had named methods for the basics:</p>
<ul>
<li><code>ptr.copy()</code>: copies the memory at pointer - doesn't drop</li>
<li><code>ptr.write(val)</code>: writes val to the memory at pointer - doesn't drop</li>
<li><code>ptr.write_drop(val)</code>: writes val to the memory at pointer, dropping the old value there</li>
<li><code>ptr.drop()</code>: drops the memory at pointer</li>
<li><code>ptr.borrow()</code>: borrows the memory at pointer: &amp;T from *const T and &amp;mut T from *mut T</li>
</ul>



<a name="169459460"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169459460" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169459460">(Jul 02 2019 at 07:35)</a>:</h4>
<p>The defaults should be unaligned memory operations, so you need then variants for <code>_aligned</code> operations.<br>
You also need variants for <code>_volatile</code>, <code>_atomic</code>, and <code>_volatile_atomic</code>.</p>



<a name="169459466"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169459466" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169459466">(Jul 02 2019 at 07:35)</a>:</h4>
<p>But while verbose, at least the API would be IMO boring and unsurprising.</p>



<a name="169482057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169482057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tom Phinney <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169482057">(Jul 02 2019 at 13:51)</a>:</h4>
<p>Why not create the full set of such variants, omitting those combinations (if any) that are intrinsically incompatible? The full set would be 5 * 2^3 = 40 primitives. </p>
<p>It may be infeasible to suggest deprecating the older non-self-documenting forms, but even so the full list would help make Rustaceans aware of the alternative choices they should consider when using raw pointers. In terms of syntax, I suggest appending the suffixes in the order <code>_volatile</code>, <code>_atomic</code>, <code>_aligned</code>.</p>



<a name="169501522"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169501522" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169501522">(Jul 02 2019 at 17:36)</a>:</h4>
<p>the advantage of allowing it is that pointers work ergonomically :P</p>



<a name="169504355"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169504355" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169504355">(Jul 02 2019 at 18:04)</a>:</h4>
<p>well I think making unaligned the default, that ship has sailed</p>



<a name="169504381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169504381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169504381">(Jul 02 2019 at 18:05)</a>:</h4>
<p>and in terms of compatibility, there is no reason to cause all the churn involves in people using raw pointers with <code>Copy</code> types</p>



<a name="169504390"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169504390" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169504390">(Jul 02 2019 at 18:05)</a>:</h4>
<p>I am not talking about "what would we do if this was pre-1.0", that ship has sailed^^</p>



<a name="169504405"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169504405" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169504405">(Jul 02 2019 at 18:05)</a>:</h4>
<p>I am trying to see if we can come up with a proposal that has a remote chance of being accepted <em>today</em></p>



<a name="169537528"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169537528" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169537528">(Jul 03 2019 at 03:57)</a>:</h4>
<p>So, I think we should more clearly enumerate the main use cases here, then we'll know more of what the problem might look like.</p>
<p>raw pointers that I use are usually for:<br>
, Copy types, so whatever<br>
, FFI opaque data which must be cleaned up with a foreign call (usually during Drop)</p>
<p>Are there other common use cases for pointers that I'm missing where you'd accidentally forget to Drop a value.</p>



<a name="169590067"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169590067" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169590067">(Jul 03 2019 at 18:18)</a>:</h4>
<p>Any type, when you need aliasing</p>



<a name="169590074"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/169590074" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#169590074">(Jul 03 2019 at 18:18)</a>:</h4>
<p>pointers to uninitialized data</p>



<a name="171430897"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes%20to%20raw%20pointers%20considered%20harmful/near/171430897" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Writes.20to.20raw.20pointers.20considered.20harmful.html#171430897">(Jul 22 2019 at 13:38)</a>:</h4>
<p>I suggested a clippy lint: <a href="https://github.com/rust-lang/rust-clippy/issues/4294" target="_blank" title="https://github.com/rust-lang/rust-clippy/issues/4294">https://github.com/rust-lang/rust-clippy/issues/4294</a></p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>